Grandstream GSD3710 Stack-based Buffer Overflow
Priority MEDIUM 57CWE-121Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-121 and the CVSS impact.
Summary
an attacker with knowledge of user/pass of Grandstream GSD3710 in its 1.0.11.13 version, could overflow the stack since it doesn't check the param length before use the strcopy instruction. The explotation of this vulnerability may lead an attacker to execute a shell with full access.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0545 92nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Grandstream | Grandstream GSD3710 | 1.0.11.13 | — | No fix listed | CNA |
- Grandstream GSD3710 VendorGrandstream Affected 1.0.11.13 Fixed in — No fix listed CNA
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:grandstream:gds3710_firmware:1.0.11.13:*:*:*:*:*:*:* | 1.0.11.13 | Vulnerable | Grandstream |
| cpe:2.3:h:grandstream:gds3710:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Grandstream |
- cpe:2.3:o:grandstream:gds3710_firmware:1.0.11.13:*:*:*:*:*:*:* Versions 1.0.11.13 Vulnerable ·Grandstream
- cpe:2.3:h:grandstream:gds3710:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Grandstream
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2022-2025
- 2026-10-03 Alias added: GHSA-3qjj-8gwh-qxvc
References
More Grandstream Gds3710 Firmware vulnerabilities
- TI-2022-01917 Grandstream GSD3710 Stack-based Buffer Overflow CVSS 3.1CRITICAL 9.8
Sources
- CVE-2022-2025 · CVE Program
- CVE-2022-2025 · NVD
- FIRST EPSS
- GHSA-3qjj-8gwh-qxvc · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences